# From twitter input to Splunk HTTP Event collector

**URL:** <https://discuss.elastic.co/t/from-twitter-input-to-splunk-http-event-collector/135709>\
**Category:** Logstash\
**Created:** [June 13, 2018, 11:47am UTC](https://discuss.elastic.co/t/from-twitter-input-to-splunk-http-event-collector/135709 "2018-06-13T11:47:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![drosys](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@drosys](https://discuss.elastic.co/u/drosys)\
**Post date:** [June 13, 2018, 11:47am UTC](https://discuss.elastic.co/t/from-twitter-input-to-splunk-http-event-collector/135709/1 "2018-06-13T11:47:58Z")

</div>

Dear All,  
I am trying to send twitter input data to HTTP Event collector of Splunk.  
The main issue is that twitter input plugin generate a JSON object which needs to be modified to become a "value" of the key "event".  
Example:  
twitter-input generate:  
{"bb": "xxxx", "c": {"z": 3, "h":u } }

The previous output cannot be sent to Splunk this way... Indeed it needs to be converted to:

{"event": {"bb": "xxxx", "c": {"z": 3, "h":u } } }

I can't find any solution to perform this operation...

For me there are 2 possibilities which I cannot find an easy way to implement:

1. Modify the JSON structure through a filter and copy the whole event inside a field ?  
Can't find how to get the full JSON info as a variable ?

2. At the output time:  
Prefix the message with:  
'{"event": '  
And suffix the message to:  
'}'

Any solution for that ?  
All the exemple found on the forum are based on the fact that the Input generates a "string" object which can obviously be manipulated with grok etc...

Thanks in advance for your help !

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [June 13, 2018, 10:02pm UTC](https://discuss.elastic.co/t/from-twitter-input-to-splunk-http-event-collector/135709/2 "2018-06-13T22:02:17Z")

</div>

I think this will shape the JSON the way you want:

```auto
filter {
	json {
     	source => message
     	target => event
     	remove_field => ["message", "@version", "@timestamp"]
  	}
  }

```

Input:

```auto
{"bb": "xxxx", "c": {"z": 3, "h": "u" } }

```

Output:

```auto
{"event":{"bb":"xxxx","c":{"h":"u","z":3}}}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2018, 10:12pm UTC](https://discuss.elastic.co/t/from-twitter-input-to-splunk-http-event-collector/135709/3 "2018-07-11T22:12:28Z")

</div>

Closed on July 11, 2018, 10:12pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.